https://cybertoolchain.io/tools/malcontent New releases and features in malcontent, tracked by The Cyber Toolchain. en Tue, 29 Sep 2026 14:46:06 GMT https://github.com/chainguard-dev/malcontent/releases/tag/v1.26.1 https://github.com/chainguard-dev/malcontent/releases/tag/v1.26.1 Tue, 29 Sep 2026 14:46:06 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.25.4 https://github.com/chainguard-dev/malcontent/releases/tag/v1.25.4 Mon, 20 Jul 2026 14:18:18 GMT malcontent v1.25.4 adds --ignore-rules to suppress specific YARA rules from scan and diff reports. • Adds `--ignore-rules` flag to exclude specific YARA rules from scan and diff report output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.25.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.25.0 Mon, 29 Jun 2026 17:00:27 GMT malcontent v1.25.0 adds guarddog v3 rules and refreshes third-party YARA rule sets for improved supply-chain threat detection. • Adds guarddog v3 detection rules, expanding coverage of malicious package behaviors. • Updates bundled third-party YARA rules (Avast, Elastic, FireEye, Mandiant, Nextron, ReversingLabs) to June 2026 snapshots. • Upgrades yara-x engine to v1.19.0, improving underlying rule evaluation performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.24.1 https://github.com/chainguard-dev/malcontent/releases/tag/v1.24.1 Fri, 12 Jun 2026 18:20:16 GMT malcontent v1.24.1 expands Java detection coverage with third-party rule updates. • `feat` expands `java` coverage for malware rule scanning • Updates bundled third-party rules to the 2026-06-12 baseline Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.23.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.23.0 Wed, 06 May 2026 21:21:35 GMT Adds rule category filtering to the CLI for targeted analysis • Add `--rule-categories` flag to filter detections by category Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.21.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.21.0 Mon, 23 Feb 2026 17:24:32 GMT Adds configurable file count, depth limits and extended link support to malcontent • Adds configurable file count limit for analysis depth • Adds configurable recursion depth limit for nested archive scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.19.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.19.0 Tue, 23 Dec 2025 22:41:43 GMT Adds support for diffing existing scan results • Add support for diffing existing scan results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.18.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.18.0 Fri, 05 Dec 2025 21:26:38 GMT Adds --all-paths flag to score all paths during diffing for holistic analysis • Adds `--all-paths` flag to `malcontent` to score all paths when diffing instead of only changed ones Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.16.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.16.0 Thu, 11 Sep 2025 18:45:25 GMT malcontent v1.16.0 adds local persistence for compiled YARA rules instead of in-memory storage. • Persist compiled rules locally rather than in-memory Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.11.1 https://github.com/chainguard-dev/malcontent/releases/tag/v1.11.1 Thu, 22 May 2025 01:43:35 GMT malcontent v1.11.1 adds support for absolute `include` paths in external calls. • Support absolute `include` paths when calling malcontent externally Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.11.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.11.0 Wed, 21 May 2025 20:16:05 GMT malcontent v1.11.0 adds report file type support and new `include` directive for rules • Use the `include` directive to centralize common private rules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.10.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.10.0 Mon, 21 Apr 2025 22:59:48 GMT Adds initial support for image diffing to malcontent v1.10.0 • Add initial support for image diffing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.9.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.9.0 Fri, 28 Mar 2025 17:25:44 GMT Adds zstd compression support for malware analysis payloads. • `feat: add basic zstd compression support` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.8.2 https://github.com/chainguard-dev/malcontent/releases/tag/v1.8.2 Wed, 15 Jan 2025 13:11:43 GMT Adds configurable scanner concurrency via new CLI flag to control number of scanners • Removes explicit Go version from golangci config (uses go.mod instead) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.8.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.8.0 Tue, 14 Jan 2025 21:22:47 GMT malcontent v1.8.0 adds zstd RPM and UPX support, stats to reports, and migrates to yara-x • Add support for zstd RPM files • Add support for UPX files • Add statistics to JSON and YAML reports • Update diff output to delineate between changed and unchanged files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.6.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.6.0 Thu, 12 Dec 2024 02:03:30 GMT Malcontent v1.6.0 adds .deb/.rpm support, Java detection, BubbleTea TUI, and fixes xz scanning • `Add support for .deb and .rpm files` — now scans RPM and Debian package archives directly. • `Add new BubbleTea TUI renderer` — provides an interactive terminal UI for scan progress and results. • Initial Java support (particularly credential stealers) — extends detection engine to identify Java-based malware patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.5.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.5.0 Mon, 18 Nov 2024 16:03:12 GMT Adds `refresh` subcommand for updating sample test data and improves detection coverage for Linux malware and Python attacks. • Add `refresh` command to update sample test data • Improve results scanning for Linux malware • Improve Python detection for EvilDojo666 attack Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.2.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.2.0 Tue, 15 Oct 2024 17:14:17 GMT Adds --file-risk-change and --file-risk-increase CLI flags to control detection thresholds. • `--file-risk-change` flag added • `--file-risk-increase` flag added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.1.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.1.0 Thu, 03 Oct 2024 12:53:25 GMT Adds `--processes` flag, multi-path support for `analyze`/`scan`, and rule severity overrides • Add `--processes` flag to scan active process commands • Allow for multiple scan path inputs for `analyze` and `scan` • Allow for rule severity overrides; add default ignore tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v1.0.0 https://github.com/chainguard-dev/malcontent/releases/tag/v1.0.0 Mon, 23 Sep 2024 15:37:43 GMT malcontent v1.0.0 is a new release of the binary analysis CLI with broader archive and program kind support. • Adds `.xz` archive support to `scan` mode for deeper inspection of compressed binaries • Extends `programkind` detection to include `.bat`, `.cpp`, `.dll`, and `.pyc` file types • Overhauls the CLI architecture using urfave/cli for improved command structure • Introduces a shorter output format option for 'scan' mode to reduce verbose logging Breaking changes: • The tool name and remote repository have changed from `bincapz` to `malcontent`; update git remotes with `git remote set-url origin git@github.com:chainguard-dev/malcontent.git` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.15.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.15.0 Fri, 12 Jul 2024 20:51:47 GMT malcontent v0.15.0 improves file move calculation coverage and reduces false positives in reverse shell detection • Allow move calculations for all files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.14.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.14.0 Tue, 09 Jul 2024 19:57:03 GMT Adds a flag to disable frequency-based upgrade heuristics and splits the ddos_refs rule. • Add `--disable-frequency-upgrade-heuristics` flag to control heuristic behavior • Split `ddos_refs` rule into separate sub-rules for improved accuracy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.13.1 https://github.com/chainguard-dev/malcontent/releases/tag/v0.13.1 Fri, 21 Jun 2024 19:16:59 GMT malcontent v0.13.1 adds --err-first-hit/miss flags to control rule error precedence • Adds `--err-first-hit` and `--err-first-miss` CLI arguments to control which result (hit or miss) is returned first when a rule produces an error. • Integrates bartblaze YARA rules into the detection engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.13.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.13.0 Thu, 06 Jun 2024 02:21:31 GMT Adds --min-*-risk CLI flags to control detection risk thresholds in malcontent • Adds `--min-*-risk` flags to allow filtering detections by minimum risk level • Adds support for the `github.com/InQuest/yara-rules-vt` external rule set Breaking changes: • The `--min-level` CLI flag is now obsolete; use `--min-*-risk` instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.12.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.12.0 Mon, 13 May 2024 21:01:05 GMT Adds Ruby Gem support and `-o` CLI flag for output destination in malcontent v0.12.0 • Add support for Ruby Gem files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.11.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.11.0 Tue, 07 May 2024 02:48:28 GMT malcontent v0.11.0 adds `--ignore-self`, archive-in-dir scanning, and rule URL output • Enables scanning of archives located within directories using `bincapz scan <dir>` • Imports YARA rule URLs into markdown and JSON output for auditability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.10.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.10.0 Wed, 24 Apr 2024 00:00:35 GMT malcontent v0.10.0 adds `--stats` flag, OCI image and archive support to its analysis capabilities • Adds `--stats` CLI flag to output run statistics including count and total metrics • Adds new input format support for OCI images • Adds new input format support for archives Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.9.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.9.0 Fri, 12 Apr 2024 20:30:24 GMT Adds `--min-file-level` for file filtering and `--verbose` flag to control log output • Adds `--min-file-level` CLI argument to filter out results for uninteresting files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.5.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.5.0 Thu, 14 Mar 2024 23:11:25 GMT malcontent v0.5.0 adds `--diff` flag for artifact comparison and markdown output rendering • Adds the `--diff` flag to enable comparison functionality • Adds markdown rendering support via refactored renderer handling Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.3.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.3.0 Sun, 03 Mar 2024 15:04:33 GMT New `include-data-files` flag, `RuleLicense` in JSON output, and generic rule support • Adds the `--include-data-files` flag to include data files in analysis. • Adds `RuleLicense` field to the JSON output format. • Enables generic rules alongside specific detection rules. Breaking changes: • The `--only-programs` flag has been renamed to `--include-data-files`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent https://github.com/chainguard-dev/malcontent/releases/tag/v0.2.0 https://github.com/chainguard-dev/malcontent/releases/tag/v0.2.0 Fri, 01 Mar 2024 20:39:37 GMT malcontent v0.2.0 adds `--omit-empty` and `--only-programs` CLI flags to control scan output and targets • `--omit-empty` flag to force-wrap output strings and omit empty results • `--only-programs` flag to restrict scans to program files only Full history on Cyber Toolchain: https://cybertoolchain.io/tools/malcontent